Malicious
Malicious

84e2f680d63d8696139fd17ff445c1fa

Share on LinkedIn
Print
PE Executable
MD5: 84e2f680d63d8696139fd17ff445c1fa
Size: 12.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 12 MB PE Executable identified by Malva.RE as Go Loader (Factory-v3) (stealer loader). Static analysis extracted 1 embedded or derived file. It matches 2 YARA rules. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
f1f46738953c18bac8378a5aac3b44d5d2e6bfdc64982e1ada5986b8b4cc7b87
MD5
84e2f680d63d8696139fd17ff445c1fa
Verdict
Malicious
File type
PE Executable · 12 MB
Family
Go Loader (Factory-v3)
Category
Stealer Loader
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/f1f46738953c18bac8378a5aac3b44d5d2e6bfdc64982e1ada5986b8b4cc7b87

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.57 MB · 12,570,823 B
First seen
2026-10-27 09:30 · an hour ago
Last seen
2026-10-27 09:30 · an hour ago
Last analysis
2026-10-27 09:30 · an hour ago
Hashes
MD5 84e2f680d63d8696139fd17ff445c1fa Sha1 ad1c28deff57a0072db8690b69c2acb39cb9e2ac Sha256 f1f46738953c18bac8378a5aac3b44d5d2e6bfdc64982e1ada5986b8b4cc7b87 Sha384 ff391849e8466820e0dfd1a7e133a045b4fac29631b73cae638dc6d85b10df7c4237bf454f16750b174f65ff01ca3da3 Sha512 f260dd3a752b51e90a889b14b4698aea84a0d0011f5c0de6db9f53b3a28a03a3d997ba7e08505a1c7d10233304c759efdf1247995d7d5d2ce9906f681d8c154b SSDeep 98304:tjhOBNrzuaCerzFi6bszT1JX4pG2IfZE+Z:yBkKr5rszpNDy+Z TLSH AAC65B11FACB54F6F9036831406BB27F23355D058B28CB9BEB183B6AF877691187A705
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXE84e2f680d63d8696139fd17ff445c1faGo Loader (Factory-v3)
Structure
BINOverlay_004cc3d4.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Overlay extracted: Overlay_004cc3d4.bin (199 bytes)
Attribution 
Loader Go Factory-v3 : le stealer livré (Vidar, Lumma ou RemusStealer selon le build) est mappé en mémoire et n'est pas attribuable statiquement.

An error has occurred. This application may no longer respond until reloaded. Reload 🗙